CVE-2021-40444

CVE-2021-40444 Использование Убедитесь, что сначала запустили setup.sh, так как вам понадобятся несколько директорий. После запуска скрипта вы сможете запустить gen.py с приведённым примером: root@kitploit: Использование python3 gen.py -d document/Sample.docx -p payload/payload.dll -i...

CVE-2026-0047-poc

CVE-2026-0047: ActivityManagerService의 누락된 권한 확인 실행 중인 모든 앱에서 탈취된 비트맵 더미 — 권한 0개, 사용자 상호작용 0회. ActivityManagerService.dumpBitmapsProto에서 enforceCallingOrSelfPermissionDUMP 확인이 누락되어, 설치된 모든 앱이 Android 16 QPR2 BetaBaklava에서 실행 중인 모든 프로세스의 UI 비트맵을 유출할 수 있습니다. 참고: 이 취약점은 저희가 발견한 것이 아닙니다. 발견 및 책임 있는 신...

bmc-tools

BMC-Tools Парсер кэша растровых изображений RDP. Входные данные bmc-tools обрабатывает файлы bcache.bmc и cache????.bin, находящиеся в профилях пользователей Windows. Использование root@kitploit: ./bmc-tools.py -h -s SRC -d DEST -c COUNT -v -o -b -w WIDTH Со следующими значениями аргументов:...

Embarcadero-Workaround

Что такое Embarcadero Workaround ? Это неофициальный "патч" для "Embarcadero VCL Library Stack/Heap Overflow" CVE-2014-0993 и CVE-2014-0994. Какие версии программного обеспечения поддерживает этот workaround? 32-битное программное обеспечение, скомпилированное с помощью Delphi и C++ Builder, где...

RdpCacheStitcher

RdpCacheStitcher RdpCacheStitcher — это инструмент, который помогает специалистам по криминалистике восстанавливать полезные изображения из битовых карт кэша RDP. Используя в качестве входных данных сырые битовые карты плиток кэша RDP, извлечённые с помощью таких инструментов, как, например,...

CVE-2026-89614

A flaw was found in the Linux kernel's NTFS file system driver. This vulnerability occurs because the free-cluster bitmap scan is not properly bounded to the volume size. A specially crafted NTFS image, where the bitmap covers more clusters than the volume actually has, can lead to an out-of-boun...

CVE-2026-89558

A flaw was found in the Linux kernel's md/raid10 RAID10 driver. This vulnerability occurs when a RAID10 array is in a degraded state and a device is being recovered while another mirror is still missing. Due to an inverted boolean value, the system incorrectly clears necessary bitmap bits, causin...

rdpy

RDPY Remote Desktop Protocol in twisted python. RDPY is a pure Python implementation of the Microsoft RDP Remote Desktop Protocol protocol client and server side. RDPY is built over the event driven network engine Twisted. RDPY support standard RDP security layer, RDP over SSL and NLA...

CVE-2021-40444-docx-Generate

CVE-2021-40444 docx 생성 CVE-2021-40444 Microsoft Office Word 원격 코드 실행를 악용하기 위한 docx 생성 1. 빈 .docx 파일을 생성합니다. 2. "삽입/개체" 메뉴에서 "비트맵 이미지" 개체를 추가합니다. 3. 저장하고 docx 압축을 풉니다. 4. word/rels/document.xml.rels 수정 5. word/document.xml 수정 6. 폴더를 압축하고 .docx로 이름 변경 7. html 및 cab 파일 준비 8. 즐기세요!...

CVE-2021-40444-docx-Generate

CVE-2021-40444 docx 생성 .docx를 생성하여 CVE-2021-40444 Microsoft Office Word 원격 코드 실행를 악용합니다. 1. 빈 docx 파일을 생성합니다. 2. "Insert/Object" 메뉴에서 "Bitmap Image" 객체를 추가합니다. Add Object...

CVE-2026-89653

In the Linux kernel, the following vulnerability has been resolved: ceph: reject exporttargets ranks = CEPHMAXMDS in mdsmap decode MDSMap exporttargets entries are monitor controlled. checknewmap uses each entry as a bit number in a fixed stack bitmap, so a rank outside the protocol namespace can...

CVE-2026-89614

In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the free-cluster bitmap scan to the volume vol-lcnemptybitsperpage is sized from vol-nrclusters at mount, but ntfsclusteralloc bounds its scan of that array by the size of $Bitmap. Those are independent on-disk...

CVE-2026-89558

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix stilldegraded being inverted in raid10syncrequest Commit fe6a19d40ceb "md/md-bitmap: merge mdbitmapstartsync into bitmapoperations" converted stilldegraded from int to bool, but inverted the assignment in the loop...

CVE-2026-89653 ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode

In the Linux kernel, the following vulnerability has been resolved: ceph: reject exporttargets ranks = CEPHMAXMDS in mdsmap decode MDSMap exporttargets entries are monitor controlled. checknewmap uses each entry as a bit number in a fixed stack bitmap, so a rank outside the protocol namespace can...

EUVD-2026-76565

In the Linux kernel, the following vulnerability has been resolved: ceph: reject exporttargets ranks = CEPHMAXMDS in mdsmap decode MDSMap exporttargets entries are monitor controlled. checknewmap uses each entry as a bit number in a fixed stack bitmap, so a rank outside the protocol namespace can...

CVE-2026-89653

This vulnerability affects the Linux kernel's Ceph filesystem (ceph) MDSMap decode path . The check_new_map() function uses monitor-controlled export_targets entries as bit numbers in a fixed stack bitmap. A rank value at or above CEPH_MAX_MDS causes set_bit() to write past the end of the array, ...

EUVD-2026-76526

In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the free-cluster bitmap scan to the volume vol-lcnemptybitsperpage is sized from vol-nrclusters at mount, but ntfsclusteralloc bounds its scan of that array by the size of $Bitmap. Those are independent on-disk...

CVE-2026-89614

This vulnerability affects the Linux kernel NTFS filesystem driver. The root cause is a slab out-of-bounds read in ntfs_cluster_alloc(): the free-cluster bitmap scan is bounded by the on-disk $Bitmap size, but the in-memory array vol->lcn_empty_bits_per_page is sized from vol->nr_clusters a...

CVE-2026-89614 ntfs: bound the free-cluster bitmap scan to the volume

In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the free-cluster bitmap scan to the volume vol-lcnemptybitsperpage is sized from vol-nrclusters at mount, but ntfsclusteralloc bounds its scan of that array by the size of $Bitmap. Those are independent on-disk...

CVE-2026-89558 md/raid10: fix still_degraded being inverted in raid10_sync_request()

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix stilldegraded being inverted in raid10syncrequest Commit fe6a19d40ceb "md/md-bitmap: merge mdbitmapstartsync into bitmapoperations" converted stilldegraded from int to bool, but inverted the assignment in the loop...